"KeePass Update Patches Vulnerability Exposing Master Password"

Open source password manager KeePass has recently released an update to patch a vulnerability allowing attackers to retrieve the cleartext master password from a memory dump.  Tracked as CVE-2023-32784 and impacting KeePass 2.x versions, the issue is related to the custom-developed textbox used for password entry, which creates a leftover string in memory for each character that the user types.  The company noted that an attacker can use a KeePass process dump, a hibernation file, a swap file, or even a RAM dump of the entire system to retrieve the strings and reconstruct the typed password.  Because the strings are ordered in memory, even multiple typed-in passwords can be retrieved.  Several weeks ago, a security researcher published a proof-of-concept (PoC) tool that can exploit the vulnerability to retrieve passwords from memory dumps.  The researcher also pointed out that the risks associated with the flaw were minimal, as remote exploitation was not possible.  KeePass announced that a patch for the bug had been included in the test version of KeePass 2.54, with the stable release scheduled for July.  The software update brings several other changes as well, including user interface and integration enhancements, new features, and other improvements and bug fixes.

SecurityWeek reports: "KeePass Update Patches Vulnerability Exposing Master Password"